CVE-2026-89905 LoongArch: BPF: Move arena register slot below TCC context
A memory corruption vulnerability in the Linux kernel's LoongArch BPF implementation allows local attackers to potentially execute code or escalate privileges when arena features are enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89905?
CVE-2026-89905 is a memory corruption vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: BPF: Move arena register slot below TCC context
Currently, the stack layout places the optional arena register slot above the tail call counter context. When arena_vm_start is dynamically enabled, it shifts the relative offset of the tcc_ptr slot within the stack frame, causing hardcoded tracking macros to mismatch and leading to memory misalignment or corruption potentially.
To fix this, move the arena register save and restore sequences below the tail call counter context slots in both build_prologue() and the epilogue.
Update __build_epilogue() to insert a proper offset decrement to safely skip the unneeded tcc_ptr reading block while accurately aligning with the relocated arena slot at the very bottom.
With this patch, the tcc_ptr slot is always positioned at a fixed distance directly underneath the base callee-saved registers that is independent of whether the arena features are on.
Which versions are affected by CVE-2026-89905?
How do I fix CVE-2026-89905?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-89905 being exploited?
There is no known exploitation of CVE-2026-89905 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-89905, GHSA-74m2-6pj4-prfm, UBUNTU-CVE-2026-89905.